Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1mbXg0LTI2cjMtd3hwZs0v8A
Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption
Impact
CommonMarker uses cmark-gfm
for rendering Github Flavored Markdown. An integer overflow in cmark-gfm
's table row parsing may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.
If affected versions of CommonMarker are used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE).
Patches
This vulnerability has been patched in the following CommonMarker release:
- v0.23.4
Workarounds
The vulnerability exists in the table markdown extensions of cmark-gfm
. Disabling any use of the table extension will prevent this vulnerability from being triggered.
References
Acknowledgements
We would like to thank Felix Wilhelm of Google's Project Zero for reporting this vulnerability
For more information
If you have any questions or comments about this advisory:
- Open an issue in CommonMarker
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mbXg0LTI2cjMtd3hwZs0v8A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: 4 months ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-fmx4-26r3-wxpf, CVE-2024-22051
References:
- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
- https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
- https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
- https://nvd.nist.gov/vuln/detail/CVE-2024-22051
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
- https://github.com/advisories/GHSA-fmx4-26r3-wxpf
Blast Radius: 48.4
Affected Packages
rubygems:commonmarker
Dependent packages: 62Dependent repositories: 317,893
Downloads: 43,035,110 total
Affected Version Ranges: < 0.23.4
Fixed in: 0.23.4
All affected versions: 0.0.1, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1, 0.3.0, 0.4.0, 0.4.1, 0.5.0, 0.5.1, 0.6.0, 0.7.0, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.14.4, 0.14.5, 0.14.6, 0.14.7, 0.14.8, 0.14.9, 0.14.11, 0.14.12, 0.14.13, 0.14.14, 0.14.15, 0.15.0, 0.16.0, 0.16.1, 0.16.2, 0.16.3, 0.16.4, 0.16.5, 0.16.6, 0.16.7, 0.16.8, 0.17.0, 0.17.1, 0.17.2, 0.17.4, 0.17.5, 0.17.6, 0.17.7, 0.17.8, 0.17.9, 0.17.10, 0.17.11, 0.17.12, 0.17.13, 0.18.0, 0.18.1, 0.18.2, 0.19.0, 0.20.0, 0.20.1, 0.20.2, 0.21.0, 0.21.1, 0.21.2, 0.22.0, 0.23.0, 0.23.1, 0.23.2
All unaffected versions: 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.23.8, 0.23.9, 0.23.10, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.1.1, 1.1.2